Computer systems are susceptible to operating system and application-level security compromises from intruders and hacker-initiated security attacks. Networked computing systems in particular offer hackers a gateway to access and corrupt the computer system of an unsuspecting user connected to the network.
One such security attack is an unauthorized write and execute event on a network server. A “Trojan horse” is an example of such an attack in which malicious or harmful code is contained within an apparently harmless program or data. An intruder, via a network connection, surreptitiously uploads an .asp (active server page) file or other type of executable file onto a network server and executes the file with an administrative privilege of the server.
A similar and common attack attempts to infect a computing device with a virus. Once instantiated on an unsuspecting user's computer, a virus attempts to override system files and exploit or reconfigure the computer's operating system to alter the intended functionality and/or disable the computing device. Viruses can be transmitted by sending them as attachments to an email, by downloading an infected program from another site, or a virus can be present on a diskette or compact disk. Additionally, viruses are often designed to spread automatically to other computer users.
Another security attack attempts to cause a buffer overrun in a network server. This is initiated by a hacker directing a single, large universal resource locator (URL) to the network server to expose a deficiency in the handling of the URL. A buffer overrun can expose an opening to overwrite and/or replace a section of the memory with executable code intended to compromise the network server and any computing devices connected to the network server.
Many network architectures and network service providers are not designed with security as a priority, nor are the multiple possibilities for a security attack accounted for. As a result, network architectures and service providers have multiple single-points of failure that are susceptible to external security attacks. When an exploitable failure point is discovered in a network server or in a computer operating system, the entire network service and associated computing devices are at risk of a security compromise.
An example of an Internet server is Internet Information Server (IIS) which is implemented to facilitate administration of a network architecture that includes and interface with the Internet. Windows® 2000 Server integrates IIS at the operating system level. Windows® 2000 Server is an operating system licensed by Microsoft Corporation of Redmond, Wash.
When IIS is implemented as a networking service to interface a network architecture with the Internet, it inherently trusts the resources and data files stored within the network architecture. Furthermore, IIS relies upon its own security features to protect against security attacks and maintain the integrity of the resources and data files stored within the network architecture.
A security feature of IIS is to authenticate users requesting access to network resources before allowing the requested access. Unfortunately, security attacks can be initiated that circumvent IIS. A trusted and authenticated user, for example, can overwrite and/or corrupt a file stored on the network, either maliciously or inadvertently. Because IIS inherently trusts the resources and data files stored on the network in which IIS is implemented, a second authenticated user may be served the corrupted file because the integrity of the file itself is not verified.